Malware Removal Forums

External WD HD infected with Win32:Kryptik.LQL

ssmad · 2013-05-25T16:15:52+00:00

Hey guys, Hopefully you guys can help me out with this. I have a 1Tb WD Hdd which I use to backup my photos and videos while I'm in the field working. I make my backup everyday in the field basically just making a folder day1, day 2 and follows. When I got back home I plugged it in my computer and as soon as I opened the drive half the folders were being shown as shortcuts. When i tired to open it avast kicked in gave me a Trojan alert and blocked the file. Avast's Shield log lists its as follows : FILE NAME: H:\.Trashes\b3fdadef.com - SEVERITY: High - STATUS: Threat: Win32:Kryptik-LQL[Tfj] - ACTION: Move to Chest - RESULT: Action Successful Now when I try to open a folder it gives the following error: Windows cannot find H:\.Trashes\b3fdadef.com. Make you you typed the name correctly are try again. I can tell that the data is still there by the overall file size on the passport. The other folders which haven't been infected are working absolutely fine. I'm on a brand new PC, I just in

16 min read

✨ The volunteers who helped with this thread aren't active anymore, but you can still get a personalized answer — click Ask AI below.

ssmad

May 27, 2013, 7:47 PM UTC

No luck I'm afraid it's still showing as a hidden folder nothing changed.

========== FILES ==========
< attrib -h -s day5 /c >
File not found - day5
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.
< ren day5.lnk old-day5.lnk /c >
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 05282013_004509

deltalima Admin/Teacher

May 27, 2013, 7:51 PM UTC

Hi ssmad,

OK, try this.

Run OTL Script





:files

attrib -h -s H:\day5 /c

ren H:\day5.lnk H:\old-day5.lnk /c

Now see if you can access the Day5 folder.

ssmad

May 27, 2013, 7:53 PM UTC

still the same I'm afraid...

========== FILES ==========
< attrib -h -a H:\day5 /c >
Not resetting system file - H:\Day5
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.
< ren H:\day5.lnk H:\old-day5.lnk /c >
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 05282013_005213

deltalima Admin/Teacher

May 27, 2013, 7:54 PM UTC

Try the last script again, I made a slight change after posting it.

ssmad

May 27, 2013, 7:56 PM UTC

Success deltalima!

========== FILES ==========
< attrib -h -s H:\day5 /c >
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.
< ren H:\day5.lnk H:\old-day5.lnk /c >
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 05282013_005434

deltalima Admin/Teacher

May 27, 2013, 7:57 PM UTC

Hi ssmad,

Run OTL Script

Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).

Copy and Paste the following code into the

textbox. Do not include the word Code





:files

attrib -h -s H:\*.* /c

del h:\*.lnk /c

attrib +h +s H:\$RECYCLE.BIN /c

attrib +h +s "H:\System Volume Information" /c

Then click the Run Fix button at the top.
Click .
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Let me know how it looks now.

Upload a File to Virustotal

Please go to Virustotal

Copy/paste this file and path into the white box at the top:

H:\.Trashes\b3fdadef.com

Press Scan it - this will submit the file for testing.
Please wait for all the scanners to finish then copy and paste the results in your next response.

ssmad

May 27, 2013, 8:02 PM UTC

Hey deltalima,

I'm not sure I follow you, the folder named Day5 is no longer being shown as a hidden folder after the last scan. The shortcut and all are still present but this particular folder is now working as normal.

So do i still run the fix and all the rest that you sent in your last post?

deltalima Admin/Teacher

May 27, 2013, 8:05 PM UTC

Yes, run the script as above and let me know how it looks.

ssmad

May 27, 2013, 8:13 PM UTC

Ok now all the shortcuts have been removed but the folders are still being shown as hidden folders.

As for Virustotal I'm afraid it's only giving me a place to upload files and trying to put the link there isn't working nor can i find the file so upload it.

========== FILES ==========
< attrib -h -s H:\*.* /c >
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.
< del h:\*.lnk /c >
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.
< attrib +h +s H:\$RECYCLE.BIN /c >
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.
< attrib +h +s "H:\System Volume Information" /c >
Access denied - H:\System Volume Information
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 05282013_010717

deltalima Admin/Teacher

May 27, 2013, 8:28 PM UTC

Hi ssmad,

Ok now all the shortcuts have been removed but the folders are still being shown as hidden folders.

OK, we are making good progress, we need to find how those folders are being hidden.

Does Day5 still show as un hidden?

Run OTL Script

Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).

Copy and Paste the following code into the

textbox. Do not include the word Code





:files

attrib H:\*.* /c

dir H:\*.* /a /c

dir H:\.Trashes\*.* /a /c

Then click the Run Fix button at the top.
Click .
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

ssmad

May 27, 2013, 8:32 PM UTC

Hey yes day5 is still being shown as unhidden.

I'm not sure if the last scan was supposed to make any changes or not, but if it was it didn't.

========== FILES ==========
< attrib H:\*.* /c >
File not found - H:\*.*
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.
< dir H:\*.* /a /c >
Volume in drive H is My Passport
Volume Serial Number is 9666-B114
Directory of H:\
05/25/2013 01:44 PM <DIR> $RECYCLE.BIN
05/28/2013 12:45 AM <DIR> .Trashes
05/15/2013 02:21 PM <DIR> 100EOS5D
05/15/2013 05:18 PM <DIR> 101GOPRO
05/04/2013 06:24 PM <DIR> Day1 Nusai
05/05/2013 06:00 PM <DIR> Day2
05/07/2013 11:00 AM <DIR> Day3
05/08/2013 05:09 PM <DIR> Day4 Ishkashim
05/09/2013 08:23 PM <DIR> Day5
05/10/2013 08:23 PM <DIR> Day6
05/12/2013 11:14 AM <DIR> Day7
05/15/2013 03:49 PM <DIR> Day8
05/15/2013 02:39 PM <DIR> Day9
05/04/2013 02:05 PM <DIR> New Folder
05/15/2013 09:32 AM <DIR> PPH Vedio for Shabbir
05/25/2013 11:54 AM <DIR> System Volume Information
0 File(s) 0 bytes
16 Dir(s) 397,076,238,336 bytes free
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.
< dir H:\.Trashes\*.* /a /c >
Volume in drive H is My Passport
Volume Serial Number is 9666-B114
Directory of H:\.Trashes
05/28/2013 12:45 AM <DIR> .
05/28/2013 12:45 AM <DIR> ..
05/11/2013 09:54 AM 63 Desktop.ini
1 File(s) 63 bytes
2 Dir(s) 397,076,238,336 bytes free
C:\Users\SS\Desktop\cmd.bat deleted successfully.
C:\Users\SS\Desktop\cmd.txt deleted successfully.

OTL by OldTimer - Version 3.2.69.0 log created on 05282013_013015

deltalima Admin/Teacher

May 27, 2013, 8:40 PM UTC

Hi ssmad,

I'm not sure if the last scan was supposed to make any changes or not, but if it was it didn't.

No, the scan was information gathering only.

Run OTL Script

Double-click OTL.exe (Right click and choose "Run as administrator" in Vista/Win7).

Copy and Paste the following code into the

textbox. Do not include the word Code





:files

attrib -h -s "H:\Day1 Nusai" /c

attrib -h -s H:\Day2 /c

attrib -h -s H:\Day3 /c

attrib -h -s "H:\Day4 Ishkashim" /c

attrib -h -s H:\Day6 /c

attrib -h -s "H:\New Folder" /c

Then click the Run Fix button at the top.
Click .
OTL may ask to reboot the machine. Please do so if asked.
The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.

Let me know how it looks now.

ssmad

May 27, 2013, 8:47 PM UTC

hey deltalima,

All the folders that were created by me look fine now and seem to open and all just as they should.

I still have three hidden folders left though

.Trashes
$RECYCLE.BIN
System Volume Information

deltalima Admin/Teacher

May 27, 2013, 8:55 PM UTC

Hi ssmad,

I still have three hidden folders left though

$RECYCLE.BIN
System Volume Information

They are legitimate and should be hidden, they are the folders that Windows uses to store deleted items so that they can be restored from the Recycle Bin and the folder used to store snapshots of the system to allow System Restore to work.

The .Trashes folder can be removed.

ESET online scannner

Note: You can use either Internet Explorer or Mozilla FireFox for this scan.

Note: If you are using Windows Vista or Windows 7, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.

First please Disable any Antivirus you have active, as shown in This topic.
Note: Don't forget to re-enable it after the scan.
Next hold down Control then click on the following link to open a new window to ESET online scannner
Press the Blue Run ESET Online Scanner button on the left side of the page.
A popup box will open.
Select the option YES, I accept the Terms of Use then click on Start.

Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
When prompted allow the Add-On/Active X to install.
Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
Now click on Advanced Settings and select the following:

Scan for potentially unwanted applications
Scan for potentially unsafe applications
Enable Anti-Stealth Technology

Now click on Start.
The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
When completed the Online Scan will begin automatically.
Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
Now click on Finish.
Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
Copy and paste that log as a reply to this topic.

Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

ssmad

May 28, 2013, 7:49 AM UTC

hey deltalima,

It seems the scan didn't pick it up at all. After the scan finished I tried to just delete the folder .trashes and was able to. Everything seems find looks good in the drive as far as I can tell.
Shall we consider this problem resolved?

ESETSmartInstaller@High as downloader log:
all ok
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6920
# api_version=3.0.2
# EOSSerial=e57e078e27a2854bb4489cefe1cacb8d
# engine=13931
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2013-05-28 04:47:25
# local_time=2013-05-28 09:47:25 (+0500, Pakistan Standard Time)
# country="United States"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=774 16777213 85 91 309004 146426317 0 0
# compatibility_mode=5893 16776573 100 94 58256 121346295 0 0
# scanned=252119
# found=5
# cleaned=0
# scan_time=27348
sh=CE0CFF1523E2DF7E436072554DEBBD86BCCDE1B8 ft=1 fh=64a8ad1547f2fc9f vn="a variant of Win32/Bundled.Toolbar.Ask application" ac=I fn="D:\Software\duplicate-file-finder-setup.exe"
sh=8F34BB9503DC54A9452821391D923FA19CE6E6FA ft=1 fh=ba0bf2bb89260abf vn="a variant of Win32/HackTool.Patcher.T application" ac=I fn="D:\Software\Adobe Acrobat XI Pro 11.0.1 Multilanguage [ChingLiu]\patch-MPT\adobe.acrobat.xi.pro.patch-MPT.exe"
sh=9B66BE44FCED8289978C552F513D94053E4D5D2A ft=1 fh=bd79624b2933f04f vn="Win32/PrcView application" ac=I fn="D:\Software\Drivers\Gigabyte\Other\Marvell\MSU\MSUSetup.exe"
sh=D2408C8A09A2BD9704AF39F818EC7AC9E9CCA46E ft=1 fh=08d2b982dc66508e vn="a variant of Win32/Bunndle application" ac=I fn="D:\Software\Windows Oct 5 2012\utorrent.exe"
sh=63E5A055D0F0D516D740E881AE9CE93440D148AA ft=1 fh=d03ef94bc0718461 vn="NSIS/TrojanDownloader.FakeAlert.DK.Gen trojan" ac=I fn="D:\Software\Windows Oct 5 2012\EASEUS.Partition.Master.v6.0.1.Professional.Edition.Retail-rG\EASEUS.Partition.Master.v6.0.1.Professional.Edition.Retail-rG\rgepm6pi\rg-setup\setup.exe"

✨ Ask AI about this thread

No ads, no affiliate links — generated on request from this thread's own archived content, not written by forum staff. Never run a scan/removal tool as a self-service step if the original thread describes it being done under a helper's direct supervision, and don't include your name, email, or other personal details in a follow-up question. See our privacy page for details on how this works.